{"schema_version":1,"title":"Fortinet Fortianalyzer Cloud vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 42 vulnerabilities in Fortinet Fortianalyzer Cloud: 34 in the last 7 days and 38 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126236, was published on 11 November 2026. 4 vulnerabilities in the last four weeks, up from none in the four before.","url":"https://junglewise.ai/threats/technologies/fortianalyzer-cloud","json_url":"https://junglewise.ai/threats/technologies/fortianalyzer-cloud.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/fortianalyzer-cloud","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":37,"all_time":42,"critical":2,"exploited":0,"last_7_days":34,"last_30_days":34,"last_90_days":38,"last_365_days":42},"latest":[{"cve":"CVE-2026-126236","cvss":7.2,"slug":"cve-2026-126236-a-improper-neutralization-of-special-elements-used-in-an-os","title":"Fortinet FortiAnalyzer OS command injection in GUI","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:22.96+00:00","url":"https://junglewise.ai/threats/cve-2026-126236-a-improper-neutralization-of-special-elements-used-in-an-os"},{"cve":"CVE-2026-126235","cvss":7.2,"slug":"cve-2026-126235-a-improper-limitation-of-a-pathname-to-a-restricted-directory","title":"Fortinet FortiAnalyzer and FortiManager path traversal in archive handling","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:22.753+00:00","url":"https://junglewise.ai/threats/cve-2026-126235-a-improper-limitation-of-a-pathname-to-a-restricted-directory"},{"cve":"CVE-2026-126234","cvss":7.2,"slug":"cve-2026-126234-a-improper-neutralization-of-special-elements-used-in-a-template","title":"Fortinet FortiAnalyzer and FortiManager template injection","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:22.607+00:00","url":"https://junglewise.ai/threats/cve-2026-126234-a-improper-neutralization-of-special-elements-used-in-a-template"},{"cve":"CVE-2026-126233","cvss":7.2,"slug":"cve-2026-126233-a-unrestricted-upload-of-file-with-dangerous-type-vulnerability","title":"Fortinet FortiAnalyzer unrestricted upload of dangerous file types","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:22.377+00:00","url":"https://junglewise.ai/threats/cve-2026-126233-a-unrestricted-upload-of-file-with-dangerous-type-vulnerability"},{"cve":"CVE-2026-126232","cvss":7.5,"slug":"cve-2026-126232-a-improper-certificate-validation-vulnerability-in-fortinet","title":"Fortinet FortiAnalyzer improper certificate validation in RADIUS","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:22.157+00:00","url":"https://junglewise.ai/threats/cve-2026-126232-a-improper-certificate-validation-vulnerability-in-fortinet"},{"cve":"CVE-2026-126231","cvss":7.2,"slug":"cve-2026-126231-a-improper-neutralization-of-special-elements-used-in-an-os","title":"Fortinet FortiAnalyzer and FortiManager OS command injection","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:21.93+00:00","url":"https://junglewise.ai/threats/cve-2026-126231-a-improper-neutralization-of-special-elements-used-in-an-os"},{"cve":"CVE-2026-126230","cvss":7.2,"slug":"cve-2026-126230-a-use-of-externally-controlled-format-string-vulnerability-in","title":"Fortinet FortiAnalyzer format string vulnerability","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:21.697+00:00","url":"https://junglewise.ai/threats/cve-2026-126230-a-use-of-externally-controlled-format-string-vulnerability-in"},{"cve":"CVE-2026-126229","cvss":9.1,"slug":"cve-2026-126229-a-authorization-bypass-through-user-controlled-key-vulnerability","title":"Fortinet FortiAnalyzer authorization bypass in dmserver","severity":"critical","exploited":false,"published_at":"2026-11-11T22:17:21.447+00:00","url":"https://junglewise.ai/threats/cve-2026-126229-a-authorization-bypass-through-user-controlled-key-vulnerability"},{"cve":"CVE-2026-126228","cvss":7.2,"slug":"cve-2026-126228-a-out-of-bounds-write-vulnerability-in-fortinet-fortianalyzer-8","title":"Fortinet FortiManager and FortiAnalyzer out-of-bounds write in dmworker","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:21.243+00:00","url":"https://junglewise.ai/threats/cve-2026-126228-a-out-of-bounds-write-vulnerability-in-fortinet-fortianalyzer-8"},{"cve":"CVE-2026-126227","cvss":7.2,"slug":"cve-2026-126227-a-unintended-proxy-or-intermediary-confused-deputy-vulnerability","title":"Fortinet FortiAnalyzer and FortiManager confused deputy in GUI","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:21.003+00:00","url":"https://junglewise.ai/threats/cve-2026-126227-a-unintended-proxy-or-intermediary-confused-deputy-vulnerability"},{"cve":"CVE-2026-126226","cvss":7.2,"slug":"cve-2026-126226-a-improper-neutralization-of-special-elements-used-in-an-os","title":"Fortinet FortiAnalyzer OS command injection in report schedule","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:20.793+00:00","url":"https://junglewise.ai/threats/cve-2026-126226-a-improper-neutralization-of-special-elements-used-in-an-os"},{"cve":"CVE-2026-126225","cvss":7.1,"slug":"cve-2026-126225-a-missing-authorization-vulnerability-in-fortinet-fortianalyzer","title":"Fortinet FortiAnalyzer privilege escalation via JSON-RPC","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:20.66+00:00","url":"https://junglewise.ai/threats/cve-2026-126225-a-missing-authorization-vulnerability-in-fortinet-fortianalyzer"},{"cve":"CVE-2026-126224","cvss":7.2,"slug":"cve-2026-126224-a-improper-neutralization-of-argument-delimiters-in-a-command","title":"Fortinet FortiAnalyzer and FortiManager argument injection","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:20.437+00:00","url":"https://junglewise.ai/threats/cve-2026-126224-a-improper-neutralization-of-argument-delimiters-in-a-command"},{"cve":"CVE-2026-126223","cvss":7.2,"slug":"cve-2026-126223-a-stack-based-buffer-overflow-vulnerability-in-fortinet","title":"Fortinet FortiAnalyzer stack-based buffer overflow in JSON-RPC API","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:20.243+00:00","url":"https://junglewise.ai/threats/cve-2026-126223-a-stack-based-buffer-overflow-vulnerability-in-fortinet"},{"cve":"CVE-2026-126222","cvss":7.2,"slug":"cve-2026-126222-a-improper-limitation-of-a-pathname-to-a-restricted-directory","title":"Fortinet FortiAnalyzer path traversal vulnerability","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:20.1+00:00","url":"https://junglewise.ai/threats/cve-2026-126222-a-improper-limitation-of-a-pathname-to-a-restricted-directory"},{"cve":"CVE-2026-126221","cvss":7.2,"slug":"cve-2026-126221-a-improper-neutralization-of-special-elements-in-output-used-by","title":"Fortinet FortiAnalyzer path traversal and injection in GUI","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:19.93+00:00","url":"https://junglewise.ai/threats/cve-2026-126221-a-improper-neutralization-of-special-elements-in-output-used-by"},{"cve":"CVE-2026-126220","cvss":7.2,"slug":"cve-2026-126220-a-improper-neutralization-of-special-elements-in-output-used-by","title":"Fortinet FortiManager injection in GUI","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:19.79+00:00","url":"https://junglewise.ai/threats/cve-2026-126220-a-improper-neutralization-of-special-elements-in-output-used-by"},{"cve":"CVE-2026-126219","cvss":7.2,"slug":"cve-2026-126219-a-improper-limitation-of-a-pathname-to-a-restricted-directory","title":"Fortinet FortiAnalyzer and FortiManager path traversal in GUI","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:19.61+00:00","url":"https://junglewise.ai/threats/cve-2026-126219-a-improper-limitation-of-a-pathname-to-a-restricted-directory"},{"cve":"CVE-2026-126217","cvss":8.7,"slug":"cve-2026-126217-a-incorrect-authorization-vulnerability-in-fortinet","title":"Fortinet FortiAnalyzer and FortiManager authorization bypass in GUI","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:19.24+00:00","url":"https://junglewise.ai/threats/cve-2026-126217-a-incorrect-authorization-vulnerability-in-fortinet"},{"cve":"CVE-2026-126215","cvss":8.2,"slug":"cve-2026-126215-a-incorrect-authorization-vulnerability-in-fortinet","title":"Fortinet FortiAnalyzer authorization bypass in GUI","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:18.86+00:00","url":"https://junglewise.ai/threats/cve-2026-126215-a-incorrect-authorization-vulnerability-in-fortinet"},{"cve":"CVE-2026-126214","cvss":7.2,"slug":"cve-2026-126214-a-authentication-bypass-by-spoofing-vulnerability-in-fortinet","title":"Fortinet FortiAnalyzer authentication bypass in GUI","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:18.663+00:00","url":"https://junglewise.ai/threats/cve-2026-126214-a-authentication-bypass-by-spoofing-vulnerability-in-fortinet"},{"cve":"CVE-2026-126213","cvss":7.1,"slug":"cve-2026-126213-a-improper-neutralization-of-special-elements-used-in-an-sql","title":"Fortinet FortiAnalyzer and FortiManager SQL injection in GUI","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:18.457+00:00","url":"https://junglewise.ai/threats/cve-2026-126213-a-improper-neutralization-of-special-elements-used-in-an-sql"},{"cve":"CVE-2026-126212","cvss":7.2,"slug":"cve-2026-126212-a-heap-based-buffer-overflow-vulnerability-in-fortinet","title":"Fortinet FortiAnalyzer heap-based buffer overflow in JSON-RPC API","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:18.263+00:00","url":"https://junglewise.ai/threats/cve-2026-126212-a-heap-based-buffer-overflow-vulnerability-in-fortinet"},{"cve":"CVE-2026-126211","cvss":7.2,"slug":"cve-2026-126211-a-improper-privilege-management-vulnerability-in-fortinet","title":"Fortinet FortiAnalyzer and FortiManager privilege escalation","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:18.1+00:00","url":"https://junglewise.ai/threats/cve-2026-126211-a-improper-privilege-management-vulnerability-in-fortinet"},{"cve":"CVE-2026-126185","cvss":7.2,"slug":"cve-2026-126185-a-improper-control-of-generation-of-code-code-injection","title":"Fortinet FortiAnalyzer and FortiManager code injection in API","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:17.83+00:00","url":"https://junglewise.ai/threats/cve-2026-126185-a-improper-control-of-generation-of-code-code-injection"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":2,"exploited":0,"vulnerabilities":34}],"related":[{"name":"Fortinet FortiOS","slug":"fortios","vulnerabilities":66,"url":"https://junglewise.ai/threats/technologies/fortios"},{"name":"Fortinet FortiManager","slug":"fortimanager","vulnerabilities":54,"url":"https://junglewise.ai/threats/technologies/fortimanager"},{"name":"Fortinet FortiManager Cloud","slug":"fortimanager-cloud","vulnerabilities":48,"url":"https://junglewise.ai/threats/technologies/fortimanager-cloud"},{"name":"Fortinet FortiAnalyzer","slug":"fortianalyzer","vulnerabilities":47,"url":"https://junglewise.ai/threats/technologies/fortianalyzer"},{"name":"Fortinet FortiProxy","slug":"fortiproxy","vulnerabilities":35,"url":"https://junglewise.ai/threats/technologies/fortiproxy"},{"name":"Fortinet FortiMail","slug":"fortimail","vulnerabilities":31,"url":"https://junglewise.ai/threats/technologies/fortimail"},{"name":"Fortinet FortiAuthenticator","slug":"fortiauthenticator","vulnerabilities":22,"url":"https://junglewise.ai/threats/technologies/fortiauthenticator"},{"name":"Fortinet FortiSandbox","slug":"fortisandbox","vulnerabilities":17,"url":"https://junglewise.ai/threats/technologies/fortisandbox"},{"name":"Fortinet FortiWeb","slug":"fortiweb","vulnerabilities":16,"url":"https://junglewise.ai/threats/technologies/fortiweb"},{"name":"Fortinet Fortisase","slug":"fortisase","vulnerabilities":13,"url":"https://junglewise.ai/threats/technologies/fortisase"},{"name":"Fortinet FortiPAM","slug":"fortipam","vulnerabilities":12,"url":"https://junglewise.ai/threats/technologies/fortipam"},{"name":"Fortinet FortiSandbox Cloud","slug":"fortisandbox-cloud","vulnerabilities":12,"url":"https://junglewise.ai/threats/technologies/fortisandbox-cloud"}],"technology":{"hub":true,"name":"Fortinet Fortianalyzer Cloud","slug":"fortianalyzer-cloud","vendor":{"hub":true,"name":"Fortinet","slug":"fortinet","url":"https://junglewise.ai/threats/vendors/fortinet"},"aliases":[],"category":"log-analytics-service","description":"Fortinet cloud-based analytics and logging platform for security appliances.","url":"https://junglewise.ai/threats/technologies/fortianalyzer-cloud"},"most_severe":[{"cve":"CVE-2026-126170","cvss":9.8,"slug":"cve-2026-126170-a-improper-encoding-or-escaping-of-output-vulnerability-in","title":"Fortinet FortiAnalyzer improper encoding of output in JRPC API","severity":"critical","exploited":false,"published_at":"2026-11-11T22:17:15.34+00:00","url":"https://junglewise.ai/threats/cve-2026-126170-a-improper-encoding-or-escaping-of-output-vulnerability-in"},{"cve":"CVE-2026-126229","cvss":9.1,"slug":"cve-2026-126229-a-authorization-bypass-through-user-controlled-key-vulnerability","title":"Fortinet FortiAnalyzer authorization bypass in dmserver","severity":"critical","exploited":false,"published_at":"2026-11-11T22:17:21.447+00:00","url":"https://junglewise.ai/threats/cve-2026-126229-a-authorization-bypass-through-user-controlled-key-vulnerability"},{"cve":"CVE-2025-46773","cvss":8.8,"epss":0.0032,"slug":"cve-2025-46773-an-improper-neutralization-of-special-elements-used-in-an-sql","title":"Fortinet FortiAnalyzer SQL injection","severity":"high","exploited":false,"published_at":"2026-10-13T18:17:11.94+00:00","url":"https://junglewise.ai/threats/cve-2025-46773-an-improper-neutralization-of-special-elements-used-in-an-sql"},{"cve":"CVE-2026-126175","cvss":8.8,"slug":"cve-2026-126175-a-improper-neutralization-of-special-elements-used-in-an-sql","title":"Fortinet FortiAnalyzer SQL injection in JSON-RPC API","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:15.747+00:00","url":"https://junglewise.ai/threats/cve-2026-126175-a-improper-neutralization-of-special-elements-used-in-an-sql"},{"cve":"CVE-2026-126217","cvss":8.7,"slug":"cve-2026-126217-a-incorrect-authorization-vulnerability-in-fortinet","title":"Fortinet FortiAnalyzer and FortiManager authorization bypass in GUI","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:19.24+00:00","url":"https://junglewise.ai/threats/cve-2026-126217-a-incorrect-authorization-vulnerability-in-fortinet"},{"cve":"CVE-2026-126215","cvss":8.2,"slug":"cve-2026-126215-a-incorrect-authorization-vulnerability-in-fortinet","title":"Fortinet FortiAnalyzer authorization bypass in GUI","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:18.86+00:00","url":"https://junglewise.ai/threats/cve-2026-126215-a-incorrect-authorization-vulnerability-in-fortinet"},{"cve":"CVE-2026-126184","cvss":8.2,"slug":"cve-2026-126184-a-authentication-bypass-by-spoofing-vulnerability-in-fortinet","title":"Fortinet FortiAnalyzer authentication bypass by spoofing","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:17.603+00:00","url":"https://junglewise.ai/threats/cve-2026-126184-a-authentication-bypass-by-spoofing-vulnerability-in-fortinet"},{"cve":"CVE-2026-22828","cvss":8.1,"epss":0.009,"slug":"cve-2026-22828-a-heap-based-buffer-overflow-vulnerability-in-fortinet","title":"A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiManager Cloud…","severity":"high","exploited":false,"published_at":"2026-04-14T16:16:37.11+00:00","url":"https://junglewise.ai/threats/cve-2026-22828-a-heap-based-buffer-overflow-vulnerability-in-fortinet"},{"cve":"CVE-2026-126177","cvss":8.1,"slug":"cve-2026-126177-a-xml-injection-aka-blind-xpath-injection-vulnerability-in","title":"Fortinet FortiAnalyzer XML injection in SAML","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:16.157+00:00","url":"https://junglewise.ai/threats/cve-2026-126177-a-xml-injection-aka-blind-xpath-injection-vulnerability-in"},{"cve":"CVE-2026-126176","cvss":8.1,"slug":"cve-2026-126176-a-xml-injection-aka-blind-xpath-injection-vulnerability-in","title":"Fortinet FortiAnalyzer XML injection in SAML API","severity":"high","exploited":false,"published_at":"2026-11-11T22:17:15.95+00:00","url":"https://junglewise.ai/threats/cve-2026-126176-a-xml-injection-aka-blind-xpath-injection-vulnerability-in"}],"generated_at":"2026-11-13T03:07:00.155039+00:00"}